# Cloudflare WAF [[Cloudflare]] WAF (Web Application Firewall) inspects HTTP requests at the edge before they reach the origin and blocks or challenges those matching attack patterns — SQL injection, XSS, RCE, CMS-specific exploits, credential stuffing, scrapers, bots, and the OWASP Top 10. WAF runs across Cloudflare's entire network: any site that points DNS at Cloudflare can opt into rule sets without changing origin code. Rules are evaluated per request in microseconds. ## Why It Matters Self-managed WAFs (ModSecurity, AWS WAF, F5) require continuous rule tuning and false-positive triage. Cloudflare ships and maintains managed rule sets — CVE-driven, updated within hours of new disclosures — and lets you write custom rules in a SQL-like expression language. For most sites, "turn it on, watch logs for a week, tune exceptions" is the entire engagement. Plan matters, though. The Free plan only gets the Free Managed Ruleset; the full Cloudflare Managed Ruleset and the OWASP Core Ruleset start at Pro. One trap: Bot Fight Mode (the free bot toggle) doesn't run on the Ruleset Engine, so no WAF custom rule or Page Rule can skip it for a given host or path. It can challenge legitimate server-to-server traffic such as third-party webhooks; on the Free plan the workaround is a DNS-only hostname. If you need exceptions, Super Bot Fight Mode (paid plans) supports Skip rules. ## Core Capabilities - **Managed Rules**: Cloudflare-curated rule sets (Cloudflare Managed, OWASP Core, exposed credential check) - **Custom Rules**: WireFilter expression language (`http.host eq "x" and ip.geoip.country eq "FR"`) - **[[Rate Limiting]]**: per-IP, per-token, per-URL request budgets - **Bot Management**: ML-driven bot scoring, separately licensed - **API Shield**: schema validation, JWT verification, mTLS - **Leaked credentials detection**: flags logins using credentials from known breaches; since August 2026 it also decodes HTTP Basic `Authorization` headers - **Application Profiles** (September 2026): positive security. The WAF learns what valid requests to your app look like (paths, parameters, headers, JSON bodies) and flags traffic that doesn't conform; you enforce it later with a custom rule - **Attack Signature Detection** (early access, September 2026): matches Managed Rules signatures in log-only mode so you can investigate before mitigating - **Threat intelligence fields** (June 2026): Cloudforce One threat intel usable directly in WAF rules ## Common Use Cases - **OWASP Top 10 mitigation** with one click (Pro plan and up) - **Geo-blocking** or geo-allowlisting - **Rate-limiting** login endpoints to slow credential stuffing - **Blocking** specific user agents, ASNs, JA4 fingerprints - **WordPress/Drupal hardening** via CMS-specific rule sets ## References - WAF home: https://www.cloudflare.com/application-services/products/waf/ - Documentation: https://developers.cloudflare.com/waf/ - WireFilter language: https://developers.cloudflare.com/ruleset-engine/rules-language/ - WAF features per plan: https://developers.cloudflare.com/waf/ - Bot Fight Mode (can't be skipped by WAF rules): https://developers.cloudflare.com/bots/get-started/bot-fight-mode/ - Changelog, threat intelligence fields (2026-06-15): https://developers.cloudflare.com/changelog/post/2026-06-15-threat-intelligence-fields/ - Changelog, leaked credentials in Authorization headers (2026-08-20): https://developers.cloudflare.com/changelog/post/2026-08-20-leaked-credentials-authorization-header/ - Changelog, Application Profiles (2026-09-07): https://developers.cloudflare.com/changelog/post/2026-09-07-application-profiles/ - Changelog, Attack Signature Detection (2026-09-07): https://developers.cloudflare.com/changelog/post/2026-09-07-attack-signature-detection/ ## Related - [[Cloudflare]] - [[Cloudflare Tunnel]] - [[Cloudflare Access and Zero Trust]] - [[Cloudflare Workers]]